Medium
CVE-2026-92714
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-91707
Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
High
CVE-2026-92619
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
High
CVE-2026-17086
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
Medium
CVE-2026-15650
RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
Medium
CVE-2026-18441
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Medium
CVE-2026-78296
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 - Unauthenticated Email Verification Bypass
Medium
CVE-2026-89278
GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
Medium
CVE-2026-12106
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
High
CVE-2026-93031
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Medium
CVE-2026-92435
Mailchimp for WooCommerce <= 6.1.0 - Missing Authorization
Medium
64453a11-e0dd-40f8-99c3-f05ef640b42b
WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller
High
CVE-2026-93485
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
Medium
CVE-2026-74017
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
Medium
CVE-2026-78295
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery
High
CVE-2026-87935
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Medium
CVE-2026-89064
All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
Medium
CVE-2026-89030
Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Missing Authorization
High
CVE-2026-88994
All Bootstrap Blocks 1.3.20 - 1.3.31 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-89063
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Medium
CVE-2026-18555
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
Medium
CVE-2026-11984
Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
High
CVE-2026-78088
Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
Critical
CVE-2026-14349
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.